@almadar/std 16.235.0 → 16.236.0

package/behaviors/lolo/infra/atoms/std-approval-gate.lolo

@@ -1,5 +1,6 @@
 app std-approval-gate "1.1.0"
 "std-approval-gate — generic approval gate / approver workflow. Use when a user voices that an action must be reviewed, approved, signed off, or authorized by a privileged role before it proceeds (admin approval, supervisor sign-off, manager approval, gatekeeper review, editor approval, senior editor approval, reviewer approval, publishing approval, draft approval, content review, submit drafts then editors review and approve or reject, needs approval before going live, requires sign-off before publish). Persists ApprovalRequest rows + surfaces the PENDING ones in a review queue showing what is being approved and who asked, with Approve / Deny actions — Deny captures a written reason. approverRoles is ENFORCED by the review transitions themselves: an APPROVE/DENY from a viewer whose role is not listed does not fire. blockSelfApproval additionally stops a reviewer approving their own request (four-eyes) — DENY stays allowed as self-withdrawal. On approval emits ApprovalGranted; on denial emits ApprovalDenied (with the reason). Hosts that replay the gated action MUST route a failed replay back via APPROVAL_REPLAY_FAILED so the request reopens instead of being silently consumed. Compose onto any orbital whose action you want to gate: the target orbital emits an external event, an ApprovalRequest row is created (stamp subjectLabel/subjectId/requestedBy so reviewers see what they are judging), and downstream effects wait on ApprovalGranted. Differs from std-mod-queue, which is content-moderation-specific."
+type ItemAction = { label : string!, event : event, variant : string, icon : string, roles : [string], when : SExpr }
 orbital ApprovalGateOrbital {
     uses Spinner from "std/behaviors/ui-spinner"
     uses Typography from "std/behaviors/ui-typography"
@@ -192,22 +193,7 @@ orbital ApprovalGateOrbital {
               variant: caption
             }]
             gap: sm
-            itemActions: [{
-              event: OPEN_SUBJECT
-              icon: eye
-              label: View
-              variant: ghost
-            }, {
-              event: APPROVE
-              icon: check
-              label: Approve
-              variant: primary
-            }, {
-              event: DENY
-              icon: x
-              label: Deny
-              variant: danger
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.tableLook
             type: data-grid
           }]
@@ -412,7 +398,6 @@ orbital ApprovalGateOrbital {
     }
 
     listens {
-      CloseButton.CLOSE -> CLOSE
       OPEN
         @description "Summons the review queue (host nav/affordance requests it)."
         @synonyms "open, show, review, view queue, open approvals"
@@ -502,30 +487,6 @@ orbital ApprovalGateOrbital {
         @description "When on, a reviewer cannot APPROVE a request they submitted themselves (requestedBy = the viewer's id) — enforced by the APPROVE transition guard, from the button or from the bus. Requires hosts to stamp requestedBy at request creation. DENY stays allowed on your own request (denying your own request withdraws it). Off by default."
         @synonyms "self approval, self-approval, four eyes, four-eyes, separation of duties, cannot approve own, no self sign-off, dual control"
         @tier "policy"
-      threshold : number = 0
-        @label "Auto-approve below this value"
-        @description "Requests whose gated value is below this threshold are auto-approved. v1.0 declarative only."
-        @synonyms "auto approve amount, skip review under, threshold, limit"
-        @tier "policy"
-      autoApproveBelowThreshold : boolean = true
-        @label "Skip review queue for low-value requests?"
-        @description "When true, auto-approves requests below the threshold without queuing. v1.0 declarative only."
-        @synonyms "auto approve, skip review, bypass queue, automatic approval"
-        @tier "policy"
-      valueField : string = ""
-        @label "Value field"
-        @description "Payload field name to compare against threshold (e.g. 'amount' on a RefundRequested event). v1.0 declarative only."
-        @tier "internal"
-      escalationHours : number = 0
-        @label "Escalate after how many hours pending?"
-        @description "Hours a request can sit pending before escalating. v1.0 declarative only."
-        @synonyms "escalation time, SLA hours, pending timeout, escalate after"
-        @tier "policy"
-      escalationRoles : [string] = []
-        @label "Who gets notified when a request escalates?"
-        @description "Roles notified on escalation (compose sibling std-notify-on-event to deliver)."
-        @synonyms "escalation contacts, escalate to, notify roles, escalated approver"
-        @tier "policy"
       tableLook : "dense" | "spacious" | "striped" | "borderless" | "card-rows" = dense
         @label "Review queue table style"
         @description "Visual treatment for the approval-queue data table."
@@ -535,6 +496,29 @@ orbital ApprovalGateOrbital {
         @label "Review slot"
         @description "UI slot the review queue renders into. Defaults to the modal overlay so the queue never seizes the host's main content; summoned via OPEN, cleared via CLOSE."
         @tier "internal"
+      itemActions : [ItemAction] = [{
+        event: OPEN_SUBJECT
+        icon: eye
+        label: View
+        variant: ghost
+      }, {
+        event: APPROVE
+        icon: check
+        label: Approve
+        variant: primary
+      }, {
+        event: DENY
+        icon: x
+        label: Deny
+        variant: danger
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }
 

package/behaviors/lolo/infra/atoms/std-audit-capture.lolo

@@ -93,11 +93,6 @@ orbital AuditCaptureOrbital {
         @description "Store a full before-and-after snapshot of each change. More detail, but a larger audit log."
         @synonyms "before after, snapshot, diff, change snapshot, field diff"
         @tier "policy"
-      retentionDays : number = 2555
-        @label "How long should the audit log be kept (days)?"
-        @description "Number of days to retain audit entries. Default 2555 ≈ 7 years, typical for compliance."
-        @synonyms "log retention, keep for, audit expiry, retention period, log lifetime"
-        @tier "policy"
     }
   }
 

package/behaviors/lolo/infra/atoms/std-cache-aside.lolo

@@ -254,10 +254,6 @@ orbital CacheEntryOrbital {
     }
 
     listens {
-      FetchButton.FETCH -> FETCH
-      InvalidateButton.INVALIDATE -> INVALIDATE
-      RefreshButton.REFRESH -> REFRESH
-      RetryButton.FETCH -> FETCH
       CACHED {
         data : CacheEntry
       }
@@ -281,26 +277,6 @@ orbital CacheEntryOrbital {
     }
 
     config {
-      ttlSeconds : number = 300
-        @label "TTL (seconds)"
-        @description "Cache entry time-to-live before it goes stale. Default 5 minutes. Shorter = fresher/real-time data; longer = stable/long-lived caching."
-        @synonyms "expiration, time to live, cache duration, freshness, real-time (short) vs long-lived (long)"
-        @tier "domain"
-      staleWhileRevalidate : boolean = true
-        @label "Serve stale while revalidating"
-        @description "When true, serve stale entries to consumers while a background refresh fetches fresh data. Reduces latency at the cost of brief staleness."
-        @synonyms "SWR, stale serving"
-        @tier "domain"
-      evictionPolicy : "lru" | "lfu" | "fifo" | "ttl-only" = lru
-        @label "Eviction policy"
-        @description "How entries are evicted when the cache fills: least-recently-used, least-frequently-used, first-in-first-out, or TTL-only (never evict early)."
-        @synonyms "cache replacement, eviction strategy"
-        @tier "domain"
-      maxCacheSize : number = 1000
-        @label "Max cache entries"
-        @description "Hard cap on cached entries before eviction. 0 = unlimited."
-        @synonyms "cache capacity, max entries"
-        @tier "domain"
       emptyLook : "illustrated" | "icon-only" | "text-only" | "mascot" = icon-only
         @label "Empty-state look"
         @description "Layer 2 visual treatment for the empty-state placeholder."

package/behaviors/lolo/infra/atoms/std-circuit-breaker.lolo

@@ -147,7 +147,7 @@ orbital ServiceNodeOrbital {
       INIT -> closed
         (set @entity.failureCount 0)
         (set @entity.successCount 0)
-        (set @entity.threshold 5)
+        (set @entity.threshold @config.failureThreshold)
         (fetch ServiceNode {
           emit: { failure: ServiceNodeLoadFailed, success: ServiceNodeLoaded }
         })
@@ -332,7 +332,6 @@ orbital ServiceNodeOrbital {
     }
 
     listens {
-      ResetButton.RESET -> RESET
       ServiceNodeLoadFailed {
         message : string
       }
@@ -347,21 +346,6 @@ orbital ServiceNodeOrbital {
         @description "Number of consecutive failures before the circuit opens and starts rejecting requests."
         @synonyms "open trigger, failure count"
         @tier "domain"
-      cooldownSeconds : number = 30
-        @label "Cooldown (seconds)"
-        @description "Seconds the circuit stays open before transitioning to half-open and probing for recovery."
-        @synonyms "reset timeout, open duration"
-        @tier "domain"
-      halfOpenRequests : number = 1
-        @label "Half-open probe requests"
-        @description "Probe requests allowed through in the half-open state before deciding to close or re-open. Lower = cautious single-probe recovery; higher = aggressive parallel re-validation."
-        @synonyms "probe count, recovery test size, probe aggressiveness, recovery test volume, cautious vs fast recovery"
-        @tier "domain"
-      fallbackBehavior : "reject" | "cached-response" | "queue" | "static-default" = reject
-        @label "Fallback behavior"
-        @description "What to return to callers while the circuit is open: reject = fail-fast/strict, cached-response = graceful degrade with stale data, queue = retry-later/no data loss, static-default = safe placeholder."
-        @synonyms "open-state response, degraded mode, fail-fast vs graceful degrade"
-        @tier "domain"
       statLook : "elevated" | "flat" | "progress-backed" | "gauge" | "sparkline" = elevated
         @label "Stat display look"
         @description "Layer 2 visual treatment for stat / KPI cards."

package/behaviors/lolo/infra/atoms/std-data-erasure.lolo

@@ -1,5 +1,6 @@
 app std-data-erasure "1.0.0"
 "std-data-erasure — GDPR Art. 17 right-to-be-forgotten queue. Tracks ErasureRequest rows through pending → grace → executed lifecycle with Cancel during grace. v1.0 ships the request lifecycle UI + knob set; auto-emit of ExecuteErasure after grace lands in v1.1 (loop-with-emit gap — docs/Almadar_Std_Factories.md). Target app/ atoms then own the actual delete or piiFields scrub via an ExecuteErasure listener."
+type ItemAction = { label : string!, event : event, variant : string, icon : string, roles : [string] }
 orbital DataErasureOrbital {
     uses Spinner from "std/behaviors/ui-spinner"
     uses Typography from "std/behaviors/ui-typography"
@@ -112,7 +113,7 @@ orbital DataErasureOrbital {
         })
       ExecScanLoaded -> execScanning when (and @config.enabled [">", (array/len ?data), 0])
         (set @entity.id (object/get (array/first ?data) id))
-        (set @entity.targetEntity (object/get (array/first ?data) targetEntity))
+        (set @entity.targetEntity (str/default (object/get (array/first ?data) targetEntity) @config.targetEntity))
         (set @entity.subjectId (object/get (array/first ?data) subjectId))
         (emit ExecuteErasure {
           requestId: @entity.id
@@ -139,7 +140,7 @@ orbital DataErasureOrbital {
         })
       ExecScanLoaded -> execScanning when [">", (array/len ?data), 0]
         (set @entity.id (object/get (array/first ?data) id))
-        (set @entity.targetEntity (object/get (array/first ?data) targetEntity))
+        (set @entity.targetEntity (str/default (object/get (array/first ?data) targetEntity) @config.targetEntity))
         (set @entity.subjectId (object/get (array/first ?data) subjectId))
         (emit ExecuteErasure {
           requestId: @entity.id
@@ -191,12 +192,7 @@ orbital DataErasureOrbital {
               variant: caption
             }]
             gap: sm
-            itemActions: [{
-              event: CANCEL_ERASURE
-              icon: x
-              label: Cancel
-              variant: secondary
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.tableLook
             type: data-grid
           }]
@@ -316,7 +312,6 @@ orbital DataErasureOrbital {
     }
 
     listens {
-      CloseButton.CLOSE -> CLOSE
       ExecScanLoaded {
         data : [ErasureRequest]
       }
@@ -396,21 +391,6 @@ orbital DataErasureOrbital {
         @label "Target entity"
         @description "Entity name whose records erasure requests apply to (e.g. 'CustomerAccount')."
         @tier "internal"
-      gracePeriodDays : number = 30
-        @label "How many days before deletion is carried out?"
-        @description "Days between request submission and execution. The subject can cancel during this window."
-        @synonyms "grace period, cancellation window, deletion delay, days before delete"
-        @tier "policy"
-      anonymizeVsDelete : "anonymize" | "delete" = anonymize
-        @label "Anonymize or fully delete the record?"
-        @description "anonymize = scrub PII fields and keep row for audit; delete = remove the row entirely."
-        @synonyms "deletion mode, anonymize, delete, scrub or remove, retention mode"
-        @tier "policy"
-      piiFields : [string] = []
-        @label "Which fields contain personal data to scrub?"
-        @description "Fields the target atom nulls when anonymizing (e.g. email, name, phone)."
-        @synonyms "PII fields, personal data fields, sensitive fields, fields to scrub"
-        @tier "policy"
       tableLook : "dense" | "spacious" | "striped" | "borderless" | "card-rows" = dense
         @label "Erasure queue table style"
         @description "Visual treatment for the erasure-requests data table."
@@ -420,6 +400,19 @@ orbital DataErasureOrbital {
         @label "Review slot"
         @description "UI slot the erasure-requests queue renders into. Defaults to the modal overlay so it never seizes the host's main content; summoned via OPEN, cleared via CLOSE."
         @tier "internal"
+      itemActions : [ItemAction] = [{
+        event: CANCEL_ERASURE
+        icon: x
+        label: Cancel
+        variant: secondary
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }
 

package/behaviors/lolo/infra/atoms/std-data-import.lolo

@@ -1,5 +1,5 @@
 app std-data-import "1.0.0"
-"std-data-import — staged CSV import run, source-agnostic: upload → staged review → confirm → parse+map → handoff. UPLOAD_CSV opens a run and persists an ImportBatch row (status uploaded, fieldMappingJson recorded verbatim for provenance); the host's file UI parses the CSV and answers with STAGE_ROWS, one JSON string per raw row, which the atom bulk-persists into import_rows against the batch id and presents as a staged review (row/error counts + Confirm/Discard). CONFIRM_IMPORT marks the batch confirmed, emits IMPORT_CONFIRMED { batchId, sourceName, rowCount }, and fetches the batch's staged rows; on fetch success the atom parses each rowJson via json/parse, remaps keys through the batch's mappingJson, and emits IMPORT_ROWS_PARSED { batchId, rows, failed } — the persist half is the CONSUMER organism's: it listens for IMPORT_ROWS_PARSED and persists the mapped rows into its own target entity (cross-atom persist into a consumer's entity is not expressible from here). This is deliberately the CSV-file path: the atom never calls a source service — sourceName/fieldMappingJson/targetEntity/historyWindowDays are declarative consumer configs, and any persist failure marks the batch row failed and fires IMPORT_FAILED, never a silent swallow. Compose with std-import for the file-picker menu."
+"std-data-import — staged CSV import run, source-agnostic: upload → staged review → confirm → parse+map → handoff. UPLOAD_CSV opens a run and persists an ImportBatch row (status uploaded, fieldMappingJson recorded verbatim for provenance); the host's file UI parses the CSV and answers with STAGE_ROWS, one JSON string per raw row, which the atom bulk-persists into import_rows against the batch id and presents as a staged review (row/error counts + Confirm/Discard). CONFIRM_IMPORT marks the batch confirmed, emits IMPORT_CONFIRMED { batchId, sourceName, rowCount }, and fetches the batch's staged rows; on fetch success the atom parses each rowJson via json/parse, remaps keys through the batch's mappingJson, and emits IMPORT_ROWS_PARSED { batchId, rows, failed } — the persist half is the CONSUMER organism's: it listens for IMPORT_ROWS_PARSED and persists the mapped rows into its own target entity (cross-atom persist into a consumer's entity is not expressible from here). This is deliberately the CSV-file path: the atom never calls a source service — sourceName/fieldMappingJson/targetEntity are consumer configs, and any persist failure marks the batch row failed and fires IMPORT_FAILED, never a silent swallow. Compose with std-import for the file-picker menu."
 orbital DataImportOrbital {
     type DataImportFile = { name : string!, size : number, type : string, content : string }
 
@@ -218,6 +218,7 @@ orbital DataImportOrbital {
               (fn k (if (object/has (json/parse @entity.mappingJson) @k)
                 (object/get (json/parse @entity.mappingJson) @k)
                 @k)))))
+          targetEntity: @config.targetEntity
         })
       ;; Same transient-failure self-loop as in `staged` — the row fetch can
       ;; fail after the batch row was already persisted as confirmed.
@@ -284,6 +285,7 @@ orbital DataImportOrbital {
         batchId : string!
         failed : number
         rows : [Map string scalar]
+        targetEntity : string
       }
         @description "Confirmed rows parsed and key-mapped: each staged row's rowJson was parsed via json/parse and remapped through the batch's mappingJson; failed counts rows whose rowJson did not parse to an object (surfaced, never dropped). The consumer persists rows into its own target entity and marks them imported."
         @synonyms "rows parsed, rows mapped, import rows ready"
@@ -330,21 +332,16 @@ orbital DataImportOrbital {
         @description "Free-form name of the upstream source this import pulls from — whatever tool or file export the user names. Recorded on the batch row for provenance and echoed on IMPORT_CONFIRMED."
         @synonyms "source, origin, import from, provider name, data source"
         @tier "domain"
+      targetEntity : string = ""
+        @label "Target entity"
+        @description "Name of the consumer organism's entity the staged rows land in after confirm. Carried on IMPORT_ROWS_PARSED so the consumer's persist half knows where the mapped rows belong — the atom never writes the target entity itself."
+        @synonyms "destination, import into, target type"
+        @tier "domain"
       fieldMappingJson : string = "{}"
         @label "Field mapping (JSON)"
         @description "JSON object mapping source CSV column names to target field names. Stored verbatim on the batch row (mappingJson); the atom applies it when it parses staged rows into IMPORT_ROWS_PARSED, so the consumer persists already-mapped rows into the target entity."
         @synonyms "field mapping, column mapping, map columns, remap fields, csv columns"
         @tier "domain"
-      targetEntity : string = ""
-        @label "Target entity"
-        @description "Name of the consumer organism's entity the staged rows land in after confirm. Declarative contract only — the atom never writes the target entity; the consumer persists on IMPORT_CONFIRMED."
-        @synonyms "destination, import into, target type"
-        @tier "domain"
-      historyWindowDays : number = 0
-        @label "Historical data range (days)"
-        @description "How many days back an import may reach (0 = unbounded). A declared import-config knob for the consumer's staging/mapping layer — the atom stages whatever rows it is handed and never filters by date."
-        @synonyms "history window, historical range, import range, days back, lookback period"
-        @tier "policy"
     }
   }
 

package/behaviors/lolo/infra/atoms/std-game-clock.lolo

@@ -13,6 +13,8 @@ orbital GameClockOrbital {
     initial: running
 
     state running {
+      INIT -> paused when (not @config.autoStart)
+        (set @entity.running false)
       PAUSE -> paused
         (set @entity.running false)
       RESUME -> running

package/behaviors/lolo/infra/atoms/std-knowledge-loop.lolo

@@ -269,11 +269,6 @@ orbital KnowledgeLoopOrbital {
     }
 
     listens {
-      SurvivedButton.SURVIVED -> SURVIVED
-      FailedButton.FAILED -> FAILED
-      ChecksAgreeButton.CHECKS_AGREE -> CHECKS_AGREE
-      ChecksDisagreeButton.CHECKS_DISAGREE -> CHECKS_DISAGREE
-      ChooseNextTargetButton.CHOOSE_NEXT_TARGET -> CHOOSE_NEXT_TARGET
       CONFIRM_SCORE {
         data: ScoreCommit
       }

package/behaviors/lolo/infra/atoms/std-lifecycle.lolo

@@ -25,7 +25,9 @@ orbital LifecycleOrbital {
 
     state idle {
       INIT -> idle
-      ScanRecordsLoaded -> scanning when (and @config.enabled [">", (array/len ?data), 0])
+      ScanRecordsLoaded -> idle when (and @config.enabled @config.dryRun [">", (array/len ?data), 0])
+        (notify info (str/concat "Dry run — " (array/len ?data) " record(s) would transition, nothing was written."))
+      ScanRecordsLoaded -> scanning when (and @config.enabled (not @config.dryRun) [">", (array/len ?data), 0])
         (set @entity.headId (object/get (array/first ?data) id))
         (set @entity.headStatus @config.toStatus)
         (emit LifecycleTransitioned { entityId: @entity.headId, status: @entity.headStatus })

package/behaviors/lolo/infra/atoms/std-mod-queue.lolo

@@ -1,5 +1,6 @@
 app std-mod-queue "1.0.0"
 "std-mod-queue — moderation queue for content review. Owns a ModQueueItem entity (one row per flagged target) and a single review trait that loads pending items, renders them in a data-grid with Approve / Reject / Escalate actions, and persists the reviewer's verdict back to the row."
+type ItemAction = { label : string!, event : event, variant : string, icon : string, roles : [string], when : SExpr }
 orbital ModQueueItemOrbital {
     uses Spinner from "std/behaviors/ui-spinner"
     uses Typography from "std/behaviors/ui-typography"
@@ -106,7 +107,21 @@ orbital ModQueueItemOrbital {
     }
 
     state loading {
-      ModQueueItemLoaded -> reviewing
+      ModQueueItemLoaded -> loading when [">", (array/len (array/filter ?data (fn row (and ["=", (object/get @row "status"), pending] [">=", (object/get @row "flagCount"), @config.autoEscalateThreshold])))), 0]
+        (set @entity.id (object/get (array/first (array/filter ?data (fn row (and ["=", (object/get @row "status"), pending] [">=", (object/get @row "flagCount"), @config.autoEscalateThreshold])))) id))
+        (persist update ModQueueItem { id: @entity.id, status: escalated } {
+          emit: { failure: ModQueueItemReviewFailed, success: ModQueueItemReviewed }
+        })
+      ModQueueItemReviewed -> loading
+        (fetch ModQueueItem {
+          emit: { failure: ModQueueItemLoadFailed, success: ModQueueItemLoaded }
+        })
+      ModQueueItemReviewFailed -> error
+        (render-ui @config.reviewSlot {
+          children: [@trait.ErrorAlert]
+          type: stack
+        })
+      ModQueueItemLoaded -> reviewing when ["=", (array/len (array/filter ?data (fn row (and ["=", (object/get @row "status"), pending] [">=", (object/get @row "flagCount"), @config.autoEscalateThreshold])))), 0]
         (render-ui @config.reviewSlot {
           children: [{
             align: center
@@ -142,22 +157,7 @@ orbital ModQueueItemOrbital {
               variant: badge
             }]
             gap: sm
-            itemActions: [{
-              event: APPROVE
-              icon: check
-              label: Approve
-              variant: primary
-            }, {
-              event: REJECT
-              icon: x
-              label: Reject
-              variant: danger
-            }, {
-              event: ESCALATE
-              icon: alert-triangle
-              label: Escalate
-              variant: secondary
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.tableLook
             type: data-grid
           }]
@@ -275,7 +275,6 @@ orbital ModQueueItemOrbital {
     }
 
     listens {
-      CloseButton.CLOSE -> CLOSE
       OPEN
         @description "Summons the moderation queue (host nav/affordance requests it)."
         @synonyms "open, show, review, view queue, moderation queue"
@@ -353,6 +352,29 @@ orbital ModQueueItemOrbital {
         @label "Review slot"
         @description "UI slot the moderation queue renders into. Defaults to the modal overlay so it never seizes the host's main content; summoned via OPEN, cleared via CLOSE."
         @tier "internal"
+      itemActions : [ItemAction] = [{
+        event: APPROVE
+        icon: check
+        label: Approve
+        variant: primary
+      }, {
+        event: REJECT
+        icon: x
+        label: Reject
+        variant: danger
+      }, {
+        event: ESCALATE
+        icon: alert-triangle
+        label: Escalate
+        variant: secondary
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }
 

package/behaviors/lolo/infra/atoms/std-notification-preferences.lolo

@@ -1,5 +1,6 @@
 app std-notification-preferences "1.0.0"
 "std-notification-preferences — per-person notification preference store plus a consultable gate. Owns NotificationPreference rows (one per person + event key: channel override in_app/email/push/slack/sms/webhook, mode instant/digest/off, quiet-hours window 'HH:MM-HH:MM' such as 22:00-07:00). The PreferencesManage trait is standard CRUD over the store (list / create / update / delete, persisted, success/failure cascade arms): a data-grid browse plus ModalRecordModal create/edit forms whose SAVE carries the full row payload (std-list daisy-chain idiom). The PreferenceGate trait is the consult half other notify traits call: emit CHECK_PREFERENCE { personId, eventKey } and the gate fetches the matching row (a row whose eventKey is blank applies to every event) and answers PREFERENCE_RESOLVED { personId, eventKey, channel, mode, suppressed } — suppressed is true only when the row's quietHours window covers the current hour; mode 'digest' rides on the verdict for the caller to defer. Default policy: no matching row — or a failed lookup — resolves fail-open to { channel: in_app, mode: instant, suppressed: false }; the absence of a preference never silences a notification."
+type ItemAction = { label : string!, event : event, variant : string, icon : string, roles : [string], when : SExpr }
 orbital NotificationPreferencesOrbital {
     uses Modal from "std/behaviors/std-modal"
 
@@ -102,17 +103,7 @@ orbital NotificationPreferencesOrbital {
               variant: caption
             }]
             gap: sm
-            itemActions: [{
-              event: EDIT
-              icon: pencil
-              label: Edit
-              variant: secondary
-            }, {
-              event: DELETE
-              icon: trash-2
-              label: Delete
-              variant: danger
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.tableLook
             type: data-grid
           }]
@@ -342,6 +333,24 @@ orbital NotificationPreferencesOrbital {
         @label "Table look"
         @description "Layer 2 visual treatment for the preference data table rendered by this atom."
         @tier "presentation"
+      itemActions : [ItemAction] = [{
+        event: EDIT
+        icon: pencil
+        label: Edit
+        variant: secondary
+      }, {
+        event: DELETE
+        icon: trash-2
+        label: Delete
+        variant: danger
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }
 

package/behaviors/lolo/infra/atoms/std-notify-on-event.lolo

@@ -382,11 +382,6 @@ orbital NotifyOnEventOrbital {
         @description "Threshold compared against `guardField` when `guardOp` is not `eq` (e.g. fire when stock drops below 5)."
         @synonyms "threshold, cutoff, limit, watermark, trigger value"
         @tier "policy"
-      listensFor : [string] = []
-        @label "Trigger events"
-        @description "Event names that should fire a notification. Set this to the upstream event name (e.g. OrderPlaced, CheckoutCompleted) so this atom listens for events from the orbital that emits them. The orbital owning this trait reacts whenever the named event fires anywhere in the schema."
-        @synonyms "subscribe to event, listen for event, react to event, watch for, wire upstream event, observe event from another orbital, cross-orbital subscription, on-event trigger"
-        @tier "internal"
       eventKey : string = ""
         @label "Event key for preferences"
         @description "Stable key naming the upstream event this listener is bound to (e.g. 'OrderPlaced'). NotificationPreference rows (std-notification-center) whose eventKey equals this key — or is blank — apply to this listener's dispatches."

package/behaviors/lolo/infra/atoms/std-permission-matrix.lolo

@@ -1,5 +1,6 @@
 app std-permission-matrix "1.0.0"
 "std-permission-matrix — role × module permission grant table / capability matrix admin surface. Use when a user voices that permissions must be managed per role and module (permission matrix, role permissions, capability matrix, permission grants, access matrix, who can see finance, hide margins, module-level permissions, admin permission screen, grant management, finance visibility by role, restrict modules by role). Persists PermissionGrant rows (workspaceId + role + module + capability flags canReadFinance / canSeeOthersHours / canSeeMargins) with full CRUD on an admin page mounted at /admin/permissions — create/edit forms are the std-modal ModalRecordModal substrate (the corpus's two-trait CRUD shape, mirroring std-list), persists live in a sibling coordinator trait, and adminRoles is ENFORCED at the persist boundary (a viewer whose role is not listed cannot fire a write, from the button or from the bus). Ships a query trait other traits consult event-wise: CHECK_GRANT { role, module } fetches the matching grant(s) and re-emits GRANT_RESOLVED { role, module, canReadFinance, canSeeOthersHours, canSeeMargins, found }. Grant SURFACE only — entity-layer @read/@update gate integration is a recorded core gap (gates are pure @entity/@user S-expressions and cannot consult another entity's rows), so enforcement stays with the consumer until that core lands."
+type ItemAction = { label : string!, event : event, variant : string, icon : string, roles : [string], when : SExpr }
 orbital PermissionMatrixOrbital {
     uses Modal from "std/behaviors/std-modal"
     uses Spinner from "std/behaviors/ui-spinner"
@@ -161,17 +162,7 @@ orbital PermissionMatrixOrbital {
               variant: caption
             }]
             gap: sm
-            itemActions: [{
-              event: EDIT
-              icon: pencil
-              label: Edit
-              variant: ghost
-            }, {
-              event: DELETE
-              icon: trash
-              label: Delete
-              variant: danger
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             type: data-grid
           }]
           direction: vertical
@@ -255,6 +246,27 @@ orbital PermissionMatrixOrbital {
     }
 
     config {}
+
+    config {
+      itemActions : [ItemAction] = [{
+        event: EDIT
+        icon: pencil
+        label: Edit
+        variant: ghost
+      }, {
+        event: DELETE
+        icon: trash
+        label: Delete
+        variant: danger
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
+    }
   }
 
   ;; Create modal: configured via `config`, no effects overrides (std-list